1 UNITED STATES DISTRICT COURT DISTRICT OF ......BRIAN C. GUDMUNDSON, ESQ. 1100 IDS Center 80 S. 8th...

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

JEANNE M. ANDERSON, RMR-RPR(651) 848-1221

1

UNITED STATES DISTRICT COURT

DISTRICT OF MINNESOTA

------------------------------------------------------------)

IN RE: TARGET CORPORATION ) Case No. 14-MD-2522(PAM/JJK)CUSTOMER DATA SECURITY BREACH )LITIGATION )

)_____________________________ )

)) St. Paul, Minnesota

This Document Relates to ) December 11, 2014All Actions ) 10:02 a.m.

)------------------------------------------------------------

BEFORE THE HONORABLE PAUL A. MAGNUSONUNITED STATES DISTRICT COURT JUDGE AND

MOTION TO DISMISS PROCEEDINGS

APPEARANCES:

FOR THE PLAINTIFFS:

Plaintiffs' Lead Counsel: Zimmerman Reed, PLLPCHARLES S. ZIMMERMAN, ESQ.BRIAN C. GUDMUNDSON, ESQ.1100 IDS Center80 S. 8th StreetMinneapolis, Minnesota 55402

Chestnut Cambronne, PAKARL L. CAMBRONNE, ESQ.17 Washington Avenue NorthSuite 300Minneapolis, Minnesota 55401-2048

Official Court Reporter: JEANNE M. ANDERSON, RMR-RPRSuite 146 U.S. Courthouse316 North Robert StreetSt. Paul, Minnesota 55101

Proceedings recorded by mechanical stenography;transcript produced by computer.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


2

APPEARANCES (Continued):

For the Plaintiffs:

Plaintiffs' Lead Counsel (Continued):

Heins Mills & Olson, PLCVINCENT J. ESADES, ESQ.DAVID R. WOODWARD, ESQ.310 Clifton AvenueMinneapolis, Minnesota 55403

Milberg LLPARIANA J. TADLER, ESQ.One Pennsylvania PlazaNew York, New York 10119

For the Plaintiffs: Stueve Siegel Hanson LLPNORMAN E. SIEGEL, ESQ.460 Nichols Road, Suite 200Kansas City, Missouri 64112

Plaintiffs' Liaison Counsel:

Nichols Kaster, PLLPE. MICHELLE DRAKE, ESQ.80 S. 8th Street, Suite 4600Minneapolis, Minnesota 55402-2242

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


3

APPEARANCES (Continued):

FOR THE DEFENDANTS:

Faegre Baker Daniels LLPWENDY J. WILDUNG, ESQ.90 S. 7th Street, Suite 2200Minneapolis, Minnesota 55402-3901

Morrison & Foerster LLPDAVID F. MCDOWELL, ESQ.707 Wilshire Boulevard, Suite 600Los Angeles, California 90017-3543

Morrison & Foerster LLPHAROLD J. McELHINNY, ESQ.425 Market StreetSan Francisco, California94105-2482

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


4

P R O C E E D I N G S

IN OPEN COURT

THE HONORABLE JUDGE PAUL MAGNUSON: Good morning,

everybody.

ALL COUNSEL: Good morning, Your Honor.

THE HONORABLE JUDGE PAUL MAGNUSON: We have the

Target Consumer Case matter, Rule 12 Motion. Mr. McElhinny,

do you want to proceed?

MR. McELHINNY: Thank you, Your Honor. Your

Honor, on my agenda I have four things that I want to

accomplish this morning. One, I would like to answer any

questions the Court has.

THE HONORABLE JUDGE PAUL MAGNUSON: Pretty good

for that size brief.

MR. McELHINNY: Well, I will just start with West

Virginia. We can get into the details on West Virginia law.

THE HONORABLE JUDGE PAUL MAGNUSON: Okay, tell me,

what is West Virginia? Okay, go ahead.

MR. McELHINNY: Can I have that read back, please?

Obviously, I want to answer whatever questions the

Court has. Two, I want to talk a little bit about the

factual background as pleaded in the Complaint, because I

want to make sure that we are all -- we are in agreement

with the Plaintiffs on the facts, and I want to make sure we

are all in agreement.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


5

Second, I want to address, take my chance to

address the question, the first question you asked at the

last hearing, which is: Is a motion to dismiss the right

procedural approach to the issues that are before the Court

today? And with my last remaining time I want to talk a

little bit about standing and the Complaint as it is

presently pleaded.

So, with that introduction, at least until I hear

questions from you, in the Plaintiff's Complaint, in

Paragraph 2 and Paragraph 180, they plead the factual

background as follows: Which is that there was a breach at

Target, but as part of that breach, the hackers obtained

access to two different kinds of information.

The first, which we've talked about, this credit

card information. And as the Complaint alleges, the hackers

were able to obtain credit card data as the card was being

swiped in the point of sale machine. And we know that up to

40 million people may have been -- guests of Target, may

have been impacted by that theft of credit card information.

In addition, but separately, we know that the

hackers were able to get into a database that contained what

I would call generally contact information. And that

contact information as it is pleaded in the Complaint, again

in Paragraphs 2 and 180, consisted of names, addresses,

email addresses, contact information. And that database may

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


6

have affected up to 70 million people who have lost contact

information. And there may be, and in fact likely is, some

overlap between that 40 and 70 million number.

So, in terms of the credit card financial, it is

40 million. In terms of names and addresses, it is 70

million, from a different database.

The last fact I want to make sure we are clear

about, or two facts, are one: There is no allegation in the

Complaint, and I am not sure there could be an allegation,

that anyone's Social Security number was hacked from Target.

There is no allegation in the Complaint that any guest gave

their Social Security number to Target and there is no

allegation in the Complaint that any Social Security number

was taken from Target.

And finally, none of the Plaintiffs in the

Complaint have alleged that they are one of the millions of

people who received actual personal notice from Target

telling them that it was likely that their information was

taken. That is the factual background, that is the 40 and

70 million numbers that people have been playing with.

Second, then, I want to address why we think a

motion to dismiss is the correct procedural device to

address the Complaint as it is presently stated. We have

submitted to Your Honor an opinion by Judge Nelson from last

July, an opinion called U.S. Hotel versus Onity, O-n-i-t-y.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


7

And in that case, Judge Nelson surveyed the evolution of

what she calls the, quote, "lost data cases." And after

doing the survey, the same cases that are before Your Honor,

she concludes that the current state of the law is that most

courts dealing with claims of these lost data cases

dismissed those claims for lack of standing. That was Judge

Nelson's conclusion.

We also cited to you a decision, Sony Gaming by

Judge Battaglia in San Diego, in which Judge Battaglia goes

out of his way in his opinion to say that he thought it was

appropriate to apply the Motion to Dismiss, the Pleading

Rules with special emphasis in the data breach consumer

cases. And that he thought it was appropriate to do that

before he unleashed the expense and the burden and the time

and the difficulty that is involved in these large class

actions with, as in this case, 114 some Plaintiffs and 353

separate state claims.

So, as I was reading these cases, I was asking

myself why is it that these Judges are coming to this

conclusion that the motion to dismiss is the right time to

start looking very carefully at these complaints? And I

think my conclusion is I think there are three reasons why

the Courts are coming to ground on this view.

The first of them is that common sense tells us

that most of these claims are not and should not be

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


8

credible. And the reason for that is because we know that

there is in existence, has been ever since we have been

using credit cards, systems put in place by the banks and by

contract, to ensure that the credit card user is not the

person who bears the risk of loss.

So, we have this system that, if it is working,

makes sure that you or I when we use our credit cards, if

something goes wrong there, we are not going to be the ones

who pay.

And so, if that system has worked correctly in

this case, common sense tells us that there should not be

consumers who are injured. They are not supposed to get

injured. So, that is the first reason, I think.

The second reason is these cases hold up huge

risks of double recovery and multiple liability against

Target. And Your Honor sees that. And Your Honor knows

from the Financial Institutions Case that there is in place

a contractual, through the card issuers and Target, a

contractual basis for allocating risk and loss from these

unauthorized transactions.

Your Honor also knows that in the Financial

Institutions Case, what we now have is classes of financial

institutions who are seeking to recover for those same

losses outside of that contract through direct tort and

their own individual claims. And that is what is preceding

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


9

the Financial Institutions Case.

But, we are still talking about the same group of

injuries, the same group of unauthorized charges, the same

charges from replacing cards. And what we have here now is

consumers who are seeking their own class action, but they

are also seeking the same body of injuries. They are

claiming the same injuries, the same expenses that the banks

have already told you in the pleadings that they have paid

for. That is one risk of double recovery.

The other risk of double recovery that we know

about is we now know that the same time that the Target hack

was going on, there were at least 40 other publicly-reported

data breaches in progress in the United States. We know

that J.P. Morgan has reported one. We know that Neiman

Marcus reported one. We know American Express, Sears, even

Goodwill Industries, all of those companies were being

hacked at the same time that Target was being hacked.

But, there is nothing in the Complaint, of any of

these complaints, that contributes their use of this credit

card only to Target. There is no way to trace that charge,

where their cards got hacked, because they haven't told us

enough facts in the Complaint to tie their alleged injury to

a Target breach, as opposed to any of these others that were

going on at the same time. So, I think courts are concerned

about this issue of multiple recovery.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


10

THE HONORABLE JUDGE PAUL MAGNUSON: Counsel, if

you are going to even start to comply with Rule 1 or Rule 8

on a short plain statement, we have got 121 pages of a

brief -- or of the Complaint here. It seems to me that you

are pretty well placed on notice. I can't see why they

should have to go down to individuals on these things.

MR. McELHINNY: Let me finish up and get there,

because I mean that's what I am -- I may not be doing it

successfully, but I want to -- I'm trying to explain to Your

Honor why other courts are in fact going beyond a short

complaint and requiring Plaintiffs to actually prove the

allegations that show that they have standing, that they

have actually suffered an injury. And that is the standing

test that an injury occurred. And to use, you know, the

Supreme Court's language that it is fairly traceable to the

breach that they are alleging.

And just the third point, Your Honor, about why

courts are doing this is that these motions to dismiss in

these data breach cases have been effective in reducing the

cases. It turns out because of these reasons, because of

the way the system works, that if you do put them to the

test, they can't plead an actual injury. That is what has

happened in all of these other cases that Judge Nelson

surveyed when the courts didn't simply presume the facts

necessary; but said, I want to see it in a pleading. The

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


11

end result is the cases go away because the injuries -- they

are not supposed to be there, and at the end of the day they

really aren't there.

And Your Honor stole my punch line; that is Rule

1. I mean, the reason we have a motion to dismiss is

because if in fact the claims -- the injuries aren't real,

if they can't be traced to the breach, at the pleading stage

is the most efficient and it's the most effective and it is

the most cost effective way of producing a fair and accurate

result. And that is what is happening in all of the cases

that we cited to Your Honor.

THE HONORABLE JUDGE PAUL MAGNUSON: Well, that

isn't happening in all of them. There are lots of people

that have data breach cases that disagree with the

conclusion of Judge Nelson.

MR. McELHINNY: And I agree with that. That is

her survey. I mean, Your Honor has read the cases. You

will form your own conclusion. I am not going to tell you

what the law is. But, it appears under Judge Nelson's

conclusion that the way the courts are tending and trending

is to this approach, particularly focusing on standing, and

focusing on the tests that the Supreme Court has issued, and

which --

THE HONORABLE JUDGE PAUL MAGNUSON: Well, you

know, admittedly, these cases are hard; that's the bottom

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


12

line.

And admittedly, I can understand both a damages

argument and a standing argument as it relates to -- as it

relates to a lot of potential people in one of these things.

But, at the same token, we have pleadings here of people

that have honest-to-goodness hurt. They have been injured

by what happened.

Now, it is for another day whether or not that is

Target's fault. But, we have allegations that people are

honestly hurt. And for me to simply sit up here and say,

well, there are people that are really hurt in this thing,

but I don't think there is that much there, because the

majority maybe don't have much there. That is not fair.

MR. McELHINNY: I don't disagree -- well, I don't

disagree with the principle that Your Honor is putting -- I

don't do this job -- I am not standing up in front of you to

ask for injustice. That is not what I am here for. And I

am not really here even yet to talk about whose fault any of

this is.

THE HONORABLE JUDGE PAUL MAGNUSON: But you are

here to say that these people don't have standing.

MR. McELHINNY: I am, Your Honor.

THE HONORABLE JUDGE PAUL MAGNUSON: And as you are

saying that the people who are here don't have standing, you

are essentially saying they don't have standing because they

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


13

weren't hurt.

MR. McELHINNY: Well, let me turn directly -- I'm

sorry, I don't mean to interrupt you.

THE HONORABLE JUDGE PAUL MAGNUSON: That's all

right.

MR. McELHINNY: Let me turn directly to standing

and be clear about what I am saying about standing, okay?

First of all, there are some things that I think everybody

agrees about, and here is one of them.

I think under the law, each one of the 114 named

Plaintiffs has to allege facts that show that each one of

those people has standing. So, in this motion, we challenge

the standing of each of those 114 people.

So, it is not enough -- we will get to Your

Honor's point, but it is not enough that if there is one or

two -- if you look at the four that they like to talk about,

if Your Honor agrees with them about the four, that doesn't

say that the rest of those people -- each one of them has to

demonstrate standing on their own. That is Judge Anderson's

opinion in Insulate SB. The Court has to look at whether

each one of these Plaintiffs has standing.

And even then it would be significant if Your

Honor decided that only four of them had pled injury,

because in order to plead all of these state claims, they

have to have a resident from each of the various states.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


14

And so, if we end up with only four, we end up with a much

smaller lawsuit with many fewer claims; and, you know, an

issue about standing until you decide it down the road.

But, it is important to look at each of these Plaintiffs

individually, because that is what the law requires.

And as Your Honor I think just pointed out, there

is a broad -- each one of these alleged Plaintiffs have a

completely different story, and the stories vary

tremendously. Over half of the named Plaintiffs don't

allege that they have ever had anyone try to do anything

unusual with their account. Nothing has happened to their

account. That is over half of the 114 people that they

named. But those people, we submit, can't possibly have

standing.

But, let me -- there is one issue that crosses

everywhere. And it is not just the damages issue, but we

think it is really important and we would hope that Your

Honor does, as well, which is that in the Complaint, the

Plaintiffs have defined the breach period as running from

November 15th to December 15th. That is their definition of

when the breach period.

And the only allegation that they make for each

one of the Plaintiffs, is that that Plaintiff used his or

her credit card sometime during the breach period. So, the

only allegation that you have in the Complaint is that the

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


15

credit card was used sometime between November 15th and

December 15th. But, they also allege -- and I am not

arguing the facts with them, this is in their Complaint;

that the software, the malware that actually took credit

card information did not go into effect until November 30th.

So, we do not have an allegation from any of these

Plaintiffs that they used their credit card during the

period when the malware was in effect.

An argument can be made -- I mean, you get to

decide how you want to approach this, obviously. You can

assume they meant it during the right time period, but I

suggest that there's three reasons why you shouldn't do

that.

THE HONORABLE JUDGE PAUL MAGNUSON: Okay?

MR. McELHINNY: One, this is data breach case

number 50. I mean, these Plaintiffs who are, you know, some

of the best Plaintiffs in this line of work in the country

know what they have to allege. And they didn't allege it

here.

Two, they just filed a First Amended Complaint.

They just filed it on December 1st. They were holding our

Motion to Dismiss in their hands. They knew this issue

would be argued this morning. And they corrected one

problem, they got a South Carolina thing because they got a

South Carolina Plaintiff, but they did not fix this problem.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


16

So --

THE HONORABLE JUDGE PAUL MAGNUSON: I didn't --

maybe I better back-up with you. I understood -- because I

quite honestly have not taken any serious look at that

Amended Complaint that came in -- that is, that they just

added a couple of Plaintiffs and everything else is the

same.

MR. McELHINNY: That is correct. But, my point is

they added the Plaintiffs because they were trying to deal

with this -- we need -- they wanted somebody to reach it,

as well. I don't know, they didn't tell me why they added

the Plaintiffs. But, they had that problem. We brought in

somebody from South Carolina. But, they know that we were

focused on this issue, as well, and they didn't fix this

problem.

And third, we know that when they moved from the

Original Complaint to the Consolidated Complaint, 156

Plaintiffs just simply disappeared. And what I suggest is,

we are not at the beginning, here. I mean, this is not the

first data breach case. It is not people who don't know

what they are doing. I don't think it is burdensome -- what

I think is not going to be important -- to require them to

plead that if somebody is going to claim an injury from a

data breach, that they used their card when the breach was

happening. And you do not have that allegation from any of

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


17

the Plaintiffs in this case.

THE HONORABLE JUDGE PAUL MAGNUSON: Now, let me

come back on this malware situation.

MR. McELHINNY: Yes, Your Honor?

THE HONORABLE JUDGE PAUL MAGNUSON: It is my

understanding that the Complaint is that people were

using -- they used their credit cards. But, the malware

comes into play because of Target Corporation -- the

allegation is that Target Corporation retained a bunch of

stuff that permitted that information to come in there.

MR. McELHINNY: I can give you the specific

complaints, but I don't think I am going to have a dispute

with Mr. Esades on this. But, the Financial Institution

Cases make that allegation, but that is not what we are

addressing here.

Here the question is, they allege that the hackers

got into the system in November 15th. And between November

15th and November 30th, they did a bunch of things in the

system that they needed to do in order to make the hack

work. But, the hack, itself, this is in their Complaint as

they allege it, didn't start until November 30th. So, no

one who used a credit card before November 30th was

influenced by the credit card stuff at all. Because they

also allege that the theft from the credit card, happened as

the card was being swiped in the machine, simultaneously.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


18

In the Financial Institutions Case, Your Honor is right,

that they then allege that the hackers took this information

and stored it in the Target system before they exfiltrated

it, and that is where they get their storage. But, there is

no allegation that this system -- that the credit card

information, as opposed to -- that is why I started with the

contact database. The contact database was stored. But,

that is just names, email addresses and phone numbers.

The credit card information was not stored in the

Target system. They took it in real time as the card was

swiped. They then stored it before they exfiltrated it.

But, there is no way -- you can ask Mr. Esades this, but I

don't think he is going to disagree with this. There is no

way under the facts as alleged in the Complaint that anyone

who used their card at Target prior to November 30th could

have been impacted. Because the software that steals it

didn't start until November 30th. And there was no prior

credit card information stored at Target.

I'm sorry, I've got to make the salient point.

This is what they need to be proving. I mean, this is -- if

they are going to plead an injury and make it directly

traceable to the event, as Clapper says -- I mean, as

Clapper says, you know, you couldn't assert a problem under

a particular statute because you didn't know that was the

statute that authorized the wiretap, you had to be able to

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


19

plead in order to challenge, which wiretap statute resulted

in the issuance of the wiretap. That is the specificity of

the allegation that is required. Here we are not asking for

that.

For this part, we are just simply saying, let's

start by limiting the class of Plaintiffs to people who

actually used their credit cards, and for some reason the

Plaintiffs refused to do that. They have the information.

They knew it was challenged. They filed an Amended

Complaint, they are not changing it.

And if these people that they named didn't use it,

it obviously knocks them out of the case. How much time?

Where am I?

THE CLERK: Fifteen minutes.

MR. McELHINNY: Left?

THE CLERK: Yes.

MR. McELHINNY: Thank you. I am not going to

waste your time and go through the rest of it. But, the

other types of injuries they allege, spending money in order

to avoid future fraud, even though they didn't have it,

being without their cards for a week or two, all of these

kinds of alleged injuries are ones that have been rejected

by courts because they don't fit under the standing, they

don't fit under the principle of allowing someone to

generate their own standing.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


20

But then to come back to the point, I don't know

who Your Honor has in mind about people who actually

suffered real injuries, but there are people who allege: I

used my card, people attempted to make false charges -- I'm

sorry, that reminds me of another point.

None of the Plaintiffs alleges whether or not the

false charges that were made were reimbursed by their banks.

That failure to plead that has been held "failed" in three

cases. The Plaintiffs know that. Again, they knew we were

raising that point and they haven't corrected it, because

they want to give the implication, although we know it can't

be true, that somehow they paid those costs when in fact we

know that they didn't. And requiring to allege that those

charges were un-reimbursed will cut through whether or not

we really have serious injury here, or whether or not we

don't.

And then finally, there is a group of people, and

I think this is who Your Honor -- who allege there were

fraudulent charges made. I lost my card. And while I lost

my card, I missed payments and I had to pay late fees.

But again, those people, even the ones who allege

that kind of un-reimbursed expense, they don't allege who

cancelled their card. Because if they cancelled their card,

we are talking about a different kettle of fish here. The

injury may be real, but whether or not they have a claim

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


21

that can go forward against Target, is not -- it can't.

Because it falls into this kettle of -- you know, some of

the people allege that they bought credit monitoring

insurance.

Well, there are a bunch of cases that say you

can't generate insurance by doing this. But, we also know

that Target bought credit monitoring insurance for everybody

in the world who wanted to sign up. So, whether or not --

in order to discuss with Your Honor whether or not there is

somebody here who suffered real injury, you really have to

pick out a plaintiff and talk about that one particular

person. And I can do that if Your Honor has a specific one.

So, the point -- just for the record, I was going

to say we also briefed our 12(b)(6) motion that suggested

350 some individual state cause of actions. I am not going

to take the time right now to discuss each of those unless

Your Honor has a question about it.

I don't think you will be stunned to hear this. I

don't think we are being unreasonable to say in a case this

large, with 114 Plaintiffs, 353 causes of action, that the

cost of which, the cost of defense of which is likely to be

a factor higher than any possible recovery.

Given the fact that there has been so much history

in these breach cases, and the courts have addressed them so

thoroughly, we don't think it is unreasonable to require

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


22

these Plaintiffs to make the showing -- this is Your Honor's

Rule 1 about the full notice.

They have read Sony Gaming. They have read all of

the cases from the Northern District of Illinois. They know

what the courts are looking for. They don't have to guess

about this. And we think it is fair. We don't think it is

unreasonable. We think it is fair. We think it is

efficient, we think it is good management, we think it is

cost effective for Your Honor to simply say to these best

lawyers in the world: You know what you have to plead.

Give it to me in a complaint.

Thank you, Your Honor. I am going to save my

remaining time for rebuttal.

THE HONORABLE JUDGE PAUL MAGNUSON: Okay. There

are two things here that I just want to mention to you.

This is applicable to both sides. One is when you get into

the negligence side, I am trying to figure out what states

bar negligence recovery because of the Economic Loss Rule.

Both of you talk about it, but I can't find the list of

where it is.

MR. McELHINNY: I can resubmit -- we submitted an

appendix --

THE HONORABLE JUDGE PAUL MAGNUSON: You sure did

and that was going to be my next statement to you.

MR. McELHINNY: I think we had permission to do

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


23

that.

THE HONORABLE JUDGE PAUL MAGNUSON: Oh, yeah, I am

sure you did. But what I want to get to -- I want to get to

that appendix business.

MR. McELHINNY: Yeah.

THE HONORABLE JUDGE PAUL MAGNUSON: And this is

just looking at -- internally for us. I know that briefs

are written because of these funny word limitations or page

limitations. We have gone through all of those machinations

over the years. And they are there for good reasons,

because there are people in this world who will abuse it.

But, I have also said all of the time that good

lawyers don't need rules. Bad lawyers don't follow them.

So --

MR. McELHINNY: Yeah, but you are talking to the

guy who is now on a timer because he was the second guy down

the trail.

THE HONORABLE JUDGE PAUL MAGNUSON: Okay. Now,

what I actually was going to get to, in the future with

respect to the briefing, you are going to get page

limitation extensions all over the place from me. And know

that, because just the very thing you have been arguing

about all this time, just what we are involved in.

And it is really difficult to try to figure out as

you read from briefing here, and then try to figure out

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


24

where we are in the appendix, the attachments, et cetera.

So, it is just a question for the future that -- go ahead,

ask for the extensions, and if they don't give it to you,

call me.

MR. McELHINNY: Your Honor knows. You are the one

who has to deal with all of this. We are in the business of

presenting it to you in the way that makes it the most

helpful to you.

THE HONORABLE JUDGE PAUL MAGNUSON: And I am not

critical of what happened, because what happened is kind of

a traditional way of doing it. But, I just happen to think

it is easier if you just read it in one stretch.

MR. McELHINNY: Thank you, Your Honor.

THE HONORABLE JUDGE PAUL MAGNUSON: It's sort of

like my other forewarning, Judges don't read footnotes in

briefs, so -- thank you.

MR. McELHINNY: That is where all of the good

stuff is. Thank you, Your Honor.

THE HONORABLE JUDGE PAUL MAGNUSON: Mr. Esades?

MR. ESADES: Good morning, Your Honor. Vincent

Esades for the concerned Plaintiffs. I think I will attempt

to follow Harold's organization at my own peril. I will not

be repetitive of the briefing and a lot of this ground was

covered in the brief.

We are not here today because Target's systems

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


25

were hacked. No system is hacker-proof. I think you see

that reflected in some of the case law where claims are

simply brought against companies where they have been

hacked. We are here because of Target's conduct and the

conduct that is detailed in the Complaint: The failure to

stop it from happening; the ignoring of repeated warnings;

and the failure to provide timely notice.

And as a result of these things independent

agencies, the DOJ, linked the fraud that was flooding the

black market right back to Target, and came and told Target:

You have been breached because we are seeing it all over the

place. And it remains on the market.

Now, products and breach cases, it is

interesting -- I understand that they want to have a

discussion of sort of the evolving area of case law, and

that is actually important, because they really fall in two

camps when you read through privacy breach cases regardless

of the time frame.

The first thing is that there is cases involving

stolen data where there is no fact evidencing that it has

actually been stolen, meaning -- sometimes we call it a

laptop out of the back seat of a car type case, where data

has been stolen, but there is no indication it has actually

been accessed. And there is no actual evidence or facts

plead, rather, that it has been misused. And also, those

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


26

cases, many of them, fail to allege very specific

allegations as to damages.

The other cases are where there is a coordinated

cyber criminal theft of data and credit card information,

where that data immediately is used and misused and

continues to be misused.

And if you look at that simple factual

differentiation, you will see the cases kind of cleave down

the middle. So, doing a survey on them, what this tells me

is there have been a lot of poorly-pled cases and a lot of

cases where the data has never been misused or the

allegations weren't there because the class reps that were

litigating the class didn't have those allegations.

So, we turn to the facts of this case, which was

Harold's, I believe his second point. The first point was

questions which I am obviously available for. The second

was facts, that 40 million may have been stolen.

Well, Target's own public disclosures told us that

they actually were stolen. There is no allegation that this

may have happened to these people. Everyone that used it

during the breach period suffered the theft of the customer

name, credit card data number, and the card's expiration

date and CVV. That is from Target and that is in the

Complaint.

Target also announced that the PIN data was

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


27

removed, as well, on December 27th. And on January 10th

they announced the names, mailing addresses, phone numbers,

and email addresses of an additional 70 million people were

stolen.

Now, with respect to that data, we have no

temporal idea when that was given to them. As a result, we

can't really be a hundred percent certain who the class

members are. Target is in possession of that information.

They are the ones that have it.

Harold referred to this as contact information. I

think the more appropriate term is personally identifiable

information. There is a reason the hackers stole it. They

are not looking to send a mailer out to everyone. They use

this information to commit identity fraud. And it is

important to them and it is extremely valuable and this is

sold on the internet.

Now, we didn't plead Social Security numbers were

stolen. We don't know what any other data may have been

stolen. We can only plead what we know at this point. And

that goes to the second point, which I want to address right

now, which is the issue of the timing.

Here is what we do know, we know that hackers

gained access on November 15th. We don't know precisely

what they were up to, but based on public reports that we

have thus far, we know that they stole customer information,

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


28

credit card information.

Now, discovery may come forward that shows us that

it was only taken from a time period where the public

documents would show that it was Black Friday, from that

point on; but, we don't know that for sure. So, when we

plead a complaint, we are not just taking information that

has been gleaned from the public, probably we are a little

bit cautious to be overly specific in a notice pleading.

Now, I can tell you that they will be able to

depose, and they have already started to depose our class

representative, who will tell them exactly when they made

charges, exactly where else they used their cards, and

exactly why they fairly traced their injury to the Target

breach.

With respect to the survey of, one, why these

cases get dismissed, I think it is important that, as I

said, they turn on the facts of the case. And when you look

at the facts that have been pled by the Plaintiffs in this

case, we have a lot of specific examples of actual injury.

And I would suggest that the multiple forms of injury that

we have alleged across the board with each class

representative cannot be compartmentalized and pull one out

and attack it and pull the others out.

If you look at the allegations across the board,

there were approximately 42 Plaintiffs who suffered

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


29

unauthorized charges and late paying fees. There were at

least 57 who lost access to their own accounts for a period

of time.

Now, it doesn't matter who cancelled the card. If

I use my card at Target, and Target tells me that card has

been compromised, and I cancelled that, and I don't have

access to funds -- because some of these accounts were

linked to bank accounts, as you can see from the

allegations. People lost access to funds they needed. Not

everybody can weather the storm of a couple of weeks without

money that they need. And it is a cognizable injury.

When Harold talks about -- when Mr. McElhinny

talks about cases where these claims have been dismissed,

they have been dismissed on standing grounds, which I have

already addressed, which is that the class members in this

case have already articulated this data was stolen, this

data was misused.

If your data was misused, and one of the reps that

they have already deposed right after he discovered the

fraudulent charges, we don't buy credit monitoring before

Target even offered it.

Now, Courts have held that that mitigation cost is

absolutely recoverable in a case where you know it has been

misused, or you know that the retailer has told you it has

been stolen by criminals who intend to use it.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


30

With respect to the double recovery argument, I

was at the other hearing. I don't think anyone is arguing

that we are asking for money that has been reimbursed to be

paid a second time. To the extent reimbursements don't

occur, and many of these late fees and un-reimbursed late

fees from missing payments because there is no way to access

accounts, we believe is recoverable; and that is not double

recovery.

And unless they are conceding that they are going

to be reimbursing the banks, which I know from, based on the

hearings, they have no intention of doing that -- they are

still seeking to dismiss them -- there is no double recovery

situation in any event.

When consumers are definitely not claiming the

same injuries, you can look at paragraph 261 for the list of

the ten specific injuries they are claiming and the each

individual paragraphs from the Plaintiffs.

Now, with respect to the same time the Target

breach was occurring, we are being told there were 40 other

breaches. They can certainly bring those to light, but

certainly the J.P. Morgan breach was not credit card

information. There's no evidence that any of the

information from the J.P. Morgan breach has been used by

anyone or is in the hands -- some people suggested that that

was just a foreign government showing that they could get

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


31

into our most protected institution, just to show they could

breach them. But, it's nothing -- throwing up red herrings

that there is other stuff going on in the world doesn't mean

that our Plaintiffs haven't sufficiently pled that they used

their card and that the card was compromised.

That the Motions to Dismiss are effective in

reducing cases, I think, is certainly true; that if you

dismiss a case, there are less cases. It reduces the cases.

I can't argue with that. But, I would argue that reducing

the cases has certainly not made retailers take more

attention and more care with respect to the process they are

putting in place for security. And one of the reasons this

case is going forward right now is that until retailers are

held more accountable for lax security, that these cases

will continue and dismissing them does not solve that

problem.

Your Honor, I can address the negligence loss rule

if you would like me to at this time.

THE HONORABLE JUDGE PAUL MAGNUSON: All I was

really -- I think I understand the negligence -- the

Economic Loss Rule. The problem I couldn't figure out is

what states are you admitting that that's prohibited, versus

what states it is not.

The subject was argued in your brief --

MR. ESADES: Yeah, Target had --

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


32

THE HONORABLE JUDGE PAUL MAGNUSON: But I didn't

devise from attachments, et cetera, who, where -- and

Counsel, I have got to tell you, I emphasize with you,

because I empathize with myself trying to figure out these

pigeonhole areas of law, and then to sit there and compare

50 states plus D.C.; that is not easy. I know that.

MR. ESADES: It isn't. And I think both sides

really attempted, and I think there was a real attempt to

try and sift through those claims.

THE HONORABLE JUDGE PAUL MAGNUSON: Well, there is

no doubt about that.

MR. ESADES: And it did prove extremely difficult,

because in some -- you know, taking the Economic Loss Rule

as an example, there were 20 states that Target argued

didn't permit the claim to go forward. Our argument to them

was in every one of those states, and it is well-settled law

in our opinion across the country where a claim is based on

an independent duty, separate and apart from contract,

independent of any contract you can go forward with a

negligence claim.

Now, you will find cases that sort of inartfully

apply this. But, if you dig down deep enough into the

cases, and that is what we tried to show in our briefing on

this; but, if you dig down deep, every one of those cases

find that there is otherwise an independent duty. Separate

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


33

and apart from a contract, you can go forward with a

negligence claim. And with respect to an independent duty,

we have briefed that, and I won't get into the allegations

on independent duty that is owed.

I mean, even the Sony case that Harold has

mentioned several times said that it is common sense that a

retailer is going to owe a duty in negligence to someone who

comes in and pays with a credit card; that they are going to

have security measures and not allow that to be shared with

a third party. And we have pled this independent duty in

all of the states.

Your Honor, we attempted to -- you know, we are

very careful in our pleading not to overstate when we didn't

have the detailed enough facts, and to put in as much

factual detail as we could given Rule 8. We did not plead

every single class plaintiff in this claim.

I know that Mr. McElhinny mentioned that 156

Plaintiffs disappeared. You know, we are in front of the

Court. We also have an administrative duty to this Court to

try not to bring in 500 class representatives, if everyone

has got to worry about discovery and we have to worry about

collecting their documents. We simply tried to give it a

basic number, as broadly as we could.

And with respect to the standing argument, the

standing argument that has been made by Target essentially

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


34

relates to, in our opinion, a class certification question.

And I will explain that. There is a difference between

Article III standing and class standing.

And it is clear from the cases we cited that

previous settlements have been done where there is one

plaintiff for multiple states, that is a class question that

gets sorted out when you decide who do you need, what is the

claim going forward, and what class representative do you

need from that particular state, if at all, because some can

be grouped, and they are frequently grouped.

Now, they claim those are settlement classes and

they don't count. But, settlement classes are no different

than litigation classes except with respect to

manageability. That is the only thing they don't have to be

the same on. So, that is absolutely good law and continues

to be done. But, if they have any arguments about the

standing, there is nothing fundamentally unfair about

applying those state laws to Target on behalf of those

residents. If they want to make a class standing argument,

we will have that debate when the parties have a chance to

fully brief those issues on class certification.

Your Honor, I would just suggest that if you look

at the individual class allegations for each one of the

class representatives, and the overall allegations and

injury, that these Plaintiffs have standing. And allowing

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


35

the case to go forward, that will allow them to prove their

damages in court, is the reason this motion should be

rejected.

THE HONORABLE JUDGE PAUL MAGNUSON: Okay.

MR. ESADES: Thank you.

THE HONORABLE JUDGE PAUL MAGNUSON: I thank you

very much.

Mr. McElhinny?

MR. McELHINNY: I am unclear on the rule here,

Judge. Do I get a new 40 minutes? In answer to Your

Honor's question --

THE HONORABLE JUDGE PAUL MAGNUSON: I will go back

to the old statement: Good lawyers don't need rules. Bad

lawyers don't follow them. So, I don't know what category I

want to put you in.

MR. McELHINNY: In answer to Your Honor's

question, Appendix C to our opening brief, and then it was

repeated, I believe, in our reply brief. It deals with the

negligence law and goes state by state as to what the

Economic Loss Rule is, and it cites authorities for that.

In their opposition for the first time, the

Plaintiffs tried to get around this by alleging a special

relationship. We have dealt with that in our reply brief,

but we have also noted that they did not plead any special

relationships in their Complaint. So, that is the

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


36

negligence issue.

Let me note that in his time, Mr. Esades did not

correct my statement to the Court. There is no disagreement

that no credit card information was stolen prior to November

30th. In terms of what was in the 70 million, I refer you

to paragraph 180 of their Complaint where they say

approximately 70 million customer names, mailing addresses,

phone numbers and email addresses were also stolen in the

data breach.

In paragraph 152 is where they allege that the

first credit card information was stolen on November 30th.

On this last standing issue, the question of

whether or not you defer constitutional standing to the

class certification was squarely addressed by Judge Anderson

in the Insulate SB case where she points out that the courts

that have done that have misread Supreme Court cases, and in

fact individual constitutional standing should be decided on

a 12(b)(1) motion. We cited that case to Your Honor.

In closing, I just want to make this point. The

people around the Plaintiffs' table, and the 800 lawyers

behind them are fabulous lawyers. And they are -- I may

change my mind about this, but they are hugely ethical

lawyers. And I want to say exactly what Mr. Esades just

said, which is that they were extremely careful not to plead

anything in this Complaint that they -- they didn't want to

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


37

be embarrassed, they didn't want to come in here and have

pled stuff they couldn't prove. And so they were

conservative and they pleaded what they could prove. And

frankly, I applaud them for that.

But, that is why you can do this motion, and it is

why it so notable that they didn't plead that people used

their cards after the malware started, because they don't

know that. If they had known that, they would have pleaded

it.

It is why it is so notable that they didn't plead

that these charges were not reimbursed. Because if they

could have pled that, that would have been a good fact for

them; but, it is not in the Complaint. And so the facts of

these various cases differ.

But, the concept, and Mr. Esades just said it to

you. He said we don't know what information was stolen. We

don't know how Target may have gotten some of this

information. Discovery will answer those questions. But,

that is where times have changed. This is a 12(b)(1)

Standing Motion.

Plaintiff's have the burden of pleading and

proving an injury, an actionable injury, or one that is

certainly impending. And we have people here who -- it has

now been over a year and no charges have ever been made to

their account, and they have to be able to plead facts that

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


38

link it fairly traceable to the Target breach.

And what Mr. Esades just told you, honestly, was

that you have in this Complaint the best they were able to

do on the facts that they know. And under Judge Nelson's

survey and where all of the other cases are, that that

doesn't make it to 12(b)(1). Thank you.

THE HONORABLE JUDGE PAUL MAGNUSON: Okay, thank

you very much.

Mr. Esades?

MR. ESADES: Your Honor, I just want to be clear

about the point that Mr. McElhinny was making about the use

of the cards.

What I believe I said is I don't know when and how

much information the hackers took after they gained access

on November 15. And just to be candid, we vetted all of our

class representatives with the idea of making sure that they

used their cards during the exact time period where we

absolutely knew. But, that is a different question than how

you plead it, okay? And that is why I think we are having a

little bit of disconnect right now.

We know the hackers got in by the 15th. And we

know for sure based on what Target said by Black Friday they

were taking them out. Maybe this isn't Target's statement

but it's the public reports.

Virtually every class representative -- and there

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


39

may be a few exceptions, I don't want to say everybody, used

their card, Black Friday or after. And we didn't plead that

because we don't know for sure that there wasn't something

happening prior to that point when the hackers had access.

That is all I am saying is I don't know. And it would be

unfair to us to conclude that we should exclude people that

may have been impacted when we don't absolutely have those

facts. That is all. Thank you, Your Honor.

THE HONORABLE JUDGE PAUL MAGNUSON: Thank you very

much. Counsel, as usual, I will take it under advisement.

We will let you know as soon as we can. I will

step out for a minute and we will get another chair in here

and come back in for a status conference.

We do have some agendas here that I think

everybody got electronically, but in any circumstance,

Jackie, I will let you pass these out to people.

In a minute we will be right back in.

(Recess.)

(Whereupon the motion was adjourned. The status

conference followed and was prepared and filed under

separate cover.)

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25


40

* * *

I, Jeanne M. Anderson, certify that the foregoing

is a correct transcript from the record of proceedings in

the above-entitled matter.

Certified by: s/ Jeanne M. AndersonJeanne M. Anderson, RMR-RPROfficial Court Reporter

1 UNITED STATES DISTRICT COURT DISTRICT OF ......BRIAN C. GUDMUNDSON, ESQ. 1100 IDS Center 80 S. 8th...

Documents

Transcript of 1 UNITED STATES DISTRICT COURT DISTRICT OF ......BRIAN C. GUDMUNDSON, ESQ. 1100 IDS Center 80 S. 8th...